Hirudo: From Fake Updates to Patched Banking Apps

Hirudo is a newly identified Android banking trojan that employs a combination of credential theft and remote access capabilities. It is delivered through apps that serve as droppers, prompting users with fake update notifications to install the trojan as a separate package. The malware replaces legitimate banking applications with modified versions that disable security checks internally, enabling stealthy operations. The campaign specifically targets eight Indonesian banking apps from seven banks, embedding a hooking engine to facilitate malicious control. Distribution leverages real advertising infrastructure such as Amazon CloudFront, and the targeting scope includes multiple countries beyond Indonesia. Analysis of backend data from August 2026 shows thousands of stolen credentials and device information. There is no known patch or remediation guidance provided.

The trojan enables attackers to steal banking credentials and gain live remote control over infected devices. By replacing legitimate banking apps with patched versions that disable security checks, the malware can bypass app-level protections, increasing the risk of unauthorized transactions and financial fraud. The campaign has resulted in thousands of stolen credentials and device records, indicating significant compromise potential. The targeting of multiple countries and use of legitimate distribution infrastructure increases the threat's reach and effectiveness.

No official patch or remediation guidance is provided. Users should avoid installing apps from untrusted sources, especially those prompting unexpected updates. Monitoring for suspicious app behavior and using mobile security solutions capable of detecting trojans like Hirudo is recommended. Organizations should educate users about the risks of fake update prompts and verify app authenticity through official app stores. Since the malware replaces legitimate banking apps with patched versions, verifying app integrity and reinstalling apps from official sources can help mitigate infection.